Sigma rule: Potentially Suspicious Child Process Of VsCode

Rule

Title

Potentially Suspicious Child Process Of VsCode

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2023-01-26

Modified

2023-10-25

File

rules/windows/process_creation/proc_creation_win_vscode_child_processes_anomalies.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles.

Log source

product

windows

category

process_creation

Detection

selection_parent:
    ParentImage|endswith: '\code.exe'
selection_children_images:
    Image|endswith:
        - '\calc.exe'
        - '\regsvr32.exe'
        - '\rundll32.exe'
        - '\cscript.exe'
        - '\wscript.exe'
selection_children_cli:
    Image|endswith:
        - '\powershell.exe'
        - '\pwsh.exe'
        - '\cmd.exe'
    CommandLine|contains:
        - 'Invoke-Expressions'
        - 'IEX'
        - 'Invoke-Command'
        - 'ICM'
        - 'DownloadString'
        - 'rundll32'
        - 'regsvr32'
        - 'wscript'
        - 'cscript'
selection_children_paths:
    Image|contains:
        # Add more suspicious locations
        - ':\Users\Public\'
        - ':\Windows\Temp\'
        - ':\Temp\'
condition: selection_parent and 1 of selection_children_*

False positives (as the rule lists them)

• In development environment where VsCode is used heavily. False positives may occur when developers use task to compile or execute different types of code. Remove or add processes accordingly

Tags

• attack.execution
• attack.stealth
• attack.t1218
• attack.t1202

MITRE ATT&CK ids this rule names

• T1202
• T1218

References

• https://twitter.com/nas_bench/status/1618021838407495681
• https://twitter.com/nas_bench/status/1618021415852335105

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_vscode_child_processes_anomalies.yml